This post is for personal reminders~
Tools Used#
Process and Details#
Firmware Preparation#
When only dealing with the main core package, the files needed for the modification process are core, rofs2, and rofs3. For flashing, core, dcp, vpl, and signature.bin are required.
General Process#
1 - Unpack core with NFECore, unpack rofs2 and rofs3 with NFE, convert rofs2 to rofs, and then convert rofs3 to rofs. Replace all files. If DIY is needed, perform DIY first. Then, calculate the size of the rofs folder obtained in hexadecimal (multiply the decimal value of the size in units of M by 1024*1024). At this point, the size of the core package is determined.
2 - Open the core package with WinHex, find the first 5400EE, and start from 5. After moving 2F positions forward, the starting address of the core is reached. The area after this is the header file area. Only modify the core size, C drive start, and C drive size. Note that for official packages: C drive start + C drive size < end address. The original size of the gap here should be retained. The corresponding adjustments should also be made to the red underline part below, with the value being: C drive start - 1
3 - Continue scrolling down with WinHex until the first 5401170E is found. From here to FFFFFFFF is the partition table. To modify the partition table for the core: reverse the values. For example, if the actual values are 01 02 03 04, enter 04 03 02 01.
The partition table to be modified starts approximately from the right side of SOS+CORE. In the image, the red box indicates the starting address, and the green box indicates the corresponding partition size. The first and last red boxes should not be modified. Enter the core size as mentioned above, and set the rofs2 and rofs3 sizes to 0. Enter the C drive size as mentioned above.
4 - The most important 0x54 segment verification, if not modified, the device will not boot after flashing!
Method:
4.1 Open rofs2 with WinHex, from the beginning B2 to before the first 5D01272D, a very short segment. After selecting, right-click, go to Edit, then Copy Block, and save it as jiaoyan with the extension fpsx (you can also add the extension afterwards).
4.2 Go back to the modified core package, select the partition table part mentioned above, right-click, go to Edit, then Copy Block as Hex Values. Then, go to the jiaoyan file and paste it at the end. Save it. Do not exit WinHex.
4.3 Open jiaoyan.fpsx with nokiacooker, then immediately save and exit. Go back to WinHex and you will see that the jiaoyan file has changed. After refreshing, check the 2 changes after 5401170E. The changed values are shown in the red box in the image. Enter the changed values into the partition table of the core package.
5 - Place the verified core package into NFECore. If resizing the rofs does not result in an error, it is successful. Also, click on Verify Modification. If all values are 2B, change them all to 2A. Make sure all the files in the rofs are ready, then click on Pack to obtain the flashing core package.